@go-to-k/cdkd 0.284.41 → 0.284.43

package/dist/{deploy-engine-CCWl_tAH.js → deploy-engine-bFTrzeeu.js}

@@ -5102,6 +5102,184 @@ function formatDockerLoginError(stderr, endpoint) {
 	if (trimmed.includes("already exists in the keychain") || trimmed.includes("Error saving credentials")) return `docker's credential helper (osxkeychain on macOS / wincred on Windows / pass / secretservice on Linux) failed to persist the ECR auth token. The "already exists in the keychain" / "Error saving credentials" output is a known docker-credential-helpers issue — unrelated to cdkd, AWS credentials, or IAM perms. Quick fix: run \`docker logout ${endpoint}\` to clear the stale entry, then retry the cdkd command. Permanent fix: edit ~/.docker/config.json and remove (or empty) the platform-specific "credsStore" entry (e.g. "osxkeychain" → "" or "desktop" on macOS Docker Desktop). Original docker stderr: ${trimmed}`;
 	return trimmed;
 }
+/**
+* Env vars the docker CLI itself reads to decide how / where to run. A resolved
+* ECS secret (or SecureString) whose NAME collides with one of these must NOT
+* override it in the docker client's own process environment: a secret named
+* `DOCKER_HOST` would redirect the client to a different daemon, and `PATH`
+* would break locating the docker binary. See issue
+* https://github.com/go-to-k/cdkd/issues/2183.
+*/
+const DOCKER_CLIENT_ENV_KEYS = /* @__PURE__ */ new Set([
+	"PATH",
+	"PATHEXT",
+	"HOME",
+	"USERPROFILE",
+	"HOMEDRIVE",
+	"HOMEPATH",
+	"DOCKER_HOST",
+	"DOCKER_CONTEXT",
+	"DOCKER_CONFIG",
+	"DOCKER_CERT_PATH",
+	"DOCKER_TLS",
+	"DOCKER_TLS_VERIFY",
+	"DOCKER_API_VERSION",
+	"DOCKER_AUTH_CONFIG",
+	"DOCKER_DEFAULT_PLATFORM",
+	"DOCKER_CUSTOM_HEADERS",
+	"DOCKER_CONTENT_TRUST",
+	"DOCKER_CONTENT_TRUST_SERVER",
+	"DOCKER_HIDE_LEGACY_COMMANDS",
+	"BUILDKIT_PROGRESS",
+	"GLIBC_TUNABLES",
+	"GCONV_PATH",
+	"BASH_ENV",
+	"SSH_AUTH_SOCK",
+	"SSH_ASKPASS",
+	"SSH_ASKPASS_REQUIRE",
+	"SSH_SK_HELPER",
+	"SSH_SK_PROVIDER",
+	"SSH_PKCS11_HELPER",
+	"SSH_AGENT_PID",
+	"AWS_ENDPOINT_URL",
+	"AWS_CA_BUNDLE",
+	"AWS_PROFILE",
+	"AWS_CONFIG_FILE",
+	"AWS_SHARED_CREDENTIALS_FILE",
+	"AWS_WEB_IDENTITY_TOKEN_FILE",
+	"AWS_CONTAINER_CREDENTIALS_FULL_URI",
+	"AWS_ROLE_ARN",
+	"AWS_EC2_METADATA_SERVICE_ENDPOINT",
+	"SSL_CERT_FILE",
+	"SSL_CERT_DIR",
+	"GODEBUG",
+	"HTTP_PROXY",
+	"HTTPS_PROXY",
+	"NO_PROXY",
+	"FTP_PROXY",
+	"ALL_PROXY"
+]);
+const DOCKER_CLIENT_ENV_KEYS_UPPER = new Set([...DOCKER_CLIENT_ENV_KEYS].map((k) => k.toUpperCase()));
+/**
+* Env-var prefixes whose WHOLE family the docker client (or a helper it execs)
+* reads, so a NAMED list is always one release behind and a colliding secret in
+* ANY member is a hazard. `LD_*` / `DYLD_*` are the dynamic loader (code
+* injection, glibc + macOS); `AWS_ENDPOINT_URL_*` is the per-service endpoint
+* family aws-sdk-go-v2 (and so `docker-credential-ecr-login`) honours — a
+* secret named `AWS_ENDPOINT_URL_ECR` walks around the exact
+* `AWS_ENDPOINT_URL` entry and redirects a request signed with the operator's
+* real credentials (#2186 round 4). No plausible secret name collides with
+* any of the three. Matched by prefix rather than enumerated (issue #2183
+* review). `SSH_` was a prefix here and was demoted to an EXACT enumeration
+* in {@link DOCKER_CLIENT_ENV_KEYS} (#2186 review round 3): the family is not
+* uniformly dangerous and is not growing, while the prefix broke realistic,
+* currently-working secrets (`SSH_PRIVATE_KEY`, GitLab CI's canonical
+* deploy-key spelling). Exported so the test fence can assert the EXACT
+* contents — a hardcoded copy in the test made the anti-shadowing fence
+* one-directional (#2186 round 4 finding 2).
+*/
+const DOCKER_CLIENT_ENV_PREFIXES = [
+	"LD_",
+	"DYLD_",
+	"AWS_ENDPOINT_URL_"
+];
+/**
+* Is `key` the name of a var the docker client reads? Case-INSENSITIVE, because
+* Windows environment lookups are, so a lowercase `docker_host` must be caught
+* too (issue #2183). Matches the exact denylist OR a prefixed family — the
+* prefix families are fail-closed on the whole prefix, so an unlisted `LD_*` /
+* `DYLD_*` / `AWS_ENDPOINT_URL_*` secret is dropped (with a rename warning)
+* rather than reaching the client.
+*/
+function isDockerClientEnvKey(key) {
+	const upper = key.toUpperCase();
+	if (DOCKER_CLIENT_ENV_KEYS_UPPER.has(upper)) return true;
+	return DOCKER_CLIENT_ENV_PREFIXES.some((prefix) => upper.startsWith(prefix));
+}
+/**
+* Is `key` a shape that cannot be a well-formed `docker run -e` variable NAME?
+* Defined POSITIVELY as the good shape's complement (#2186 round 5): a valid
+* name is non-empty and contains neither `=` nor NUL. Enumerating the bad
+* spellings one at a time closed `=` in round 4 and left the empty key (`-e ''`
+* — docker rejects it with an opaque error naming no secret) and a NUL-bearing
+* key still open. A sensitive key matching this takes the same fail-closed
+* collision path as a docker-client-var name: no `-e` flag, no spawn-env entry,
+* reported in `collisions`. (This is the NAME only; a secret VALUE containing a
+* NUL is a separate pre-existing leak tracked in issue #2189.)
+*/
+function isMalformedEnvKey(key) {
+	return key.length === 0 || key.includes("=") || key.includes("\0");
+}
+/**
+* Split a container's environment into `docker run` `-e` flags and the values
+* that must travel through the spawn env instead of the argv.
+*
+* - a NON-sensitive key becomes `-e KEY=value` on the argv (unchanged);
+* - a sensitive key becomes a value-less `-e KEY`, its value returned in
+*   `sensitiveEnv` for {@link dockerSpawnEnvWithSensitive};
+* - a sensitive key that NAMES a docker-client var ({@link isDockerClientEnvKey}
+*   — the exact denylist plus the prefix families, so an external caller must
+*   use the predicate, not `DOCKER_CLIENT_ENV_KEYS.has`) gets NO flag at all,
+*   its value is dropped, and the key is reported in `collisions` so the
+*   caller can warn;
+* - a sensitive key of a MALFORMED shape ({@link isMalformedEnvKey} — empty,
+*   or containing `=` / NUL) takes the same fail-closed path (#2186 rounds
+*   4-5). The denylist matches the WHOLE key string, but Node serialises env
+*   as `key=value` and the OS parses the variable NAME as everything before
+*   the FIRST `=` — so a secret named `PATH=/tmp/evil:` is not a denylist
+*   match while the environ it produces (`PATH=/tmp/evil:=<secret>`) POISONS
+*   the client's `PATH`, and the poisoned duplicate wins (measured). The
+*   docker CLI execs `docker-credential-*` helpers off `PATH`, so that is code
+*   execution as the operator. Defining the GOOD shape positively also catches
+*   the empty key (`-e ''`, an opaque docker rejection) in one predicate.
+*
+* The collision case is why the argv half lives here beside the env half.
+* Emitting `-e KEY` for a key that `dockerSpawnEnvWithSensitive` refuses to
+* set makes docker resolve the flag against the CLIENT's own environment, so
+* the container silently receives the HOST's value for that var (issue #2183)
+* -- e.g. the host's `HTTPS_PROXY` credential, or a macOS `PATH` inside a
+* Linux image. Dropping the flag is what makes "not forwarded" literally true.
+*/
+function partitionSensitiveEnv(env, sensitiveKeys) {
+	const flags = [];
+	const sensitiveEnv = {};
+	const collisions = [];
+	for (const [k, v] of Object.entries(env)) {
+		if (!sensitiveKeys.has(k)) {
+			flags.push("-e", `${k}=${v}`);
+			continue;
+		}
+		if (isMalformedEnvKey(k) || isDockerClientEnvKey(k)) {
+			collisions.push(k);
+			continue;
+		}
+		flags.push("-e", k);
+		sensitiveEnv[k] = v;
+	}
+	return {
+		flags,
+		sensitiveEnv,
+		collisions
+	};
+}
+/**
+* Build the environment for a `docker run` that forwards value-less `-e KEY`
+* flags (the pattern that keeps secret VALUES off the argv / `/proc/<pid>/cmdline`).
+* The child gets the full parent env plus the sensitive passthrough, but the
+* docker client's own critical vars ({@link isDockerClientEnvKey}) are kept
+* authoritative from `process.env`, so a user-controlled secret NAME cannot
+* hijack the client (issue #2183). Callers should partition through
+* {@link partitionSensitiveEnv}, which never puts a colliding key in
+* `sensitiveEnv`; the guard here is defence in depth.
+*/
+function dockerSpawnEnvWithSensitive(sensitiveEnv) {
+	const env = { ...process.env };
+	for (const [k, v] of Object.entries(sensitiveEnv)) {
+		if (isMalformedEnvKey(k) || isDockerClientEnvKey(k)) continue;
+		env[k] = v;
+	}
+	return env;
+}
 function mergeEnv(overrides) {
 	const merged = { ...process.env };
 	for (const [k, v] of Object.entries(overrides)) if (v === void 0) delete merged[k];
@@ -7594,6 +7772,26 @@ function displaySafe(value, opts) {
 //#endregion
 //#region src/state/lock-manager.ts
 /**
+* Upper bound on the gap between lock renewals.
+*
+* Deliberately a fixed wall-clock ceiling rather than a pure fraction of the
+* TTL. A fraction alone (TTL/4 = 7.5 min at the default) makes renewal
+* unobservable in any deploy shorter than that, so nothing short of a
+* multi-hour fixture could ever prove the loop runs -- and an untestable
+* heartbeat is one that goes dead silently. At 2 min the default 30 min TTL
+* tolerates FOURTEEN consecutive missed renewals before it lapses, and an
+* ordinary broad-set integ (~8 min) performs three.
+*/
+const MAX_RENEWAL_INTERVAL_MS = 120 * 1e3;
+/**
+* Renew after at most a quarter of the TTL, so a short TTL still gets three
+* chances to renew before it lapses. This is what binds the two numbers
+* together for a caller that shortens `ttlMinutes`.
+*/
+const RENEWAL_TTL_FRACTION = 4;
+/** Floor, so a pathologically small TTL cannot spin the event loop. */
+const MIN_RENEWAL_INTERVAL_MS = 1e3;
+/**
 * S3-based lock manager using conditional writes (If-None-Match)
 *
 * Implements distributed locking using S3's If-None-Match: "*" condition
@@ -7615,13 +7813,20 @@ var LockManager = class {
 	s3Client;
 	config;
 	ttlMs;
+	renewalIntervalMs;
+	renewalDisabled;
+	/** Locks held by THIS process, keyed by S3 lock key. */
+	heldLocks = /* @__PURE__ */ new Map();
 	clientResolved = false;
 	resolveInFlight = null;
 	constructor(s3Client, config, options) {
 		this.s3Client = s3Client;
 		this.config = config;
 		const ttlMinutes = options?.ttlMinutes ?? 30;
+		if (!(ttlMinutes > 0) || !Number.isFinite(ttlMinutes)) throw new LockError(`Lock TTL must be a positive number of minutes (got ${String(ttlMinutes)}). A non-positive TTL makes every lock born expired, and the renewal interval clamps to its floor, so the heartbeat would spin one request per second for the life of the process.`);
 		this.ttlMs = ttlMinutes * 60 * 1e3;
+		this.renewalDisabled = options?.disableRenewal === true;
+		this.renewalIntervalMs = Math.max(MIN_RENEWAL_INTERVAL_MS, Math.min(MAX_RENEWAL_INTERVAL_MS, Math.floor(this.ttlMs / RENEWAL_TTL_FRACTION)));
 	}
 	/**
 	* Resolve the state bucket's actual region and, if it differs from the
@@ -7702,6 +7907,7 @@ var LockManager = class {
 	* Check if a lock is expired based on its expiresAt field
 	*/
 	isLockExpired(lockInfo) {
+		if (!Number.isFinite(lockInfo.expiresAt)) return true;
 		return Date.now() >= lockInfo.expiresAt;
 	}
 	/**
@@ -7736,40 +7942,50 @@ var LockManager = class {
 		};
 		try {
 			this.logger.debug(`Attempting to acquire lock for stack: ${stackName} (${region})`);
-			const lockBody = JSON.stringify(lockInfo, null, 2);
-			await this.s3Client.send(new PutObjectCommand({
-				Bucket: this.config.bucket,
-				...await this.ownerParam(),
-				Key: key,
-				Body: lockBody,
-				ContentLength: Buffer.byteLength(lockBody),
-				ContentType: "application/json",
-				IfNoneMatch: "*"
-			}));
+			const etag = await this.putLockObject(key, lockInfo);
 			this.logger.debug(`Lock acquired for stack: ${stackName} (${region}), owner: ${lockOwner}`);
+			this.trackHeldLock({
+				stackName,
+				region,
+				key,
+				info: lockInfo,
+				etag
+			});
 			return true;
 		} catch (error) {
-			if (error instanceof S3ServiceException && error.name === "PreconditionFailed") {
+			if (this.isForeignLockError(error)) {
 				this.logger.debug(`Lock already exists for stack: ${stackName} (${region})`);
-				const existingLock = await this.getLockInfo(stackName, region);
-				if (existingLock && this.isLockExpired(existingLock)) {
-					this.logger.info(`Expired lock detected for stack: ${stackName} (${region}, owner: ${existingLock.owner}, expired ${this.formatDuration(now - existingLock.expiresAt)} ago). Cleaning up...`);
-					await this.deleteLock(stackName, region);
+				const existing = await this.getLockRecord(stackName, region);
+				if (existing && this.isLockExpired(existing.info)) {
+					if (existing.etag === void 0) {
+						this.logger.warn(`Cannot take over the expired lock for stack '${stackName}' (${region}): its current version could not be identified, so removing it could delete a lock another process has since taken. Clear it with cdkd force-unlock.`);
+						return false;
+					}
+					try {
+						await this.deleteLock(stackName, region, existing.etag);
+					} catch (deleteError) {
+						if (this.isConditionUnsupportedError(deleteError)) {
+							this.logger.warn(`Cannot take over the expired lock for stack '${stackName}' (${region}): this endpoint or policy will not evaluate a conditional delete, and removing it unconditionally could delete a lock another process has since taken. Clear it with cdkd force-unlock.`);
+							return false;
+						} else if (this.isNotOursError(deleteError)) {
+							this.logger.debug(`Expired lock for stack ${stackName} (${region}) changed before takeover; treating as contended`);
+							return false;
+						} else throw deleteError;
+					}
+					this.logger.warn(`Took over an EXPIRED lock for stack: ${stackName} (${region}, owner: ${existing.info.owner}, expired ${this.formatDuration(now - existing.info.expiresAt)} ago). A live cdkd process renews its lock well inside the TTL, so this normally means the previous owner crashed or was suspended -- if it is in fact still running, both processes are now writing to the same stack.`);
 					try {
-						const retryBody = JSON.stringify(lockInfo, null, 2);
-						await this.s3Client.send(new PutObjectCommand({
-							Bucket: this.config.bucket,
-							...await this.ownerParam(),
-							Key: key,
-							Body: retryBody,
-							ContentLength: Buffer.byteLength(retryBody),
-							ContentType: "application/json",
-							IfNoneMatch: "*"
-						}));
+						const retryEtag = await this.putLockObject(key, lockInfo);
 						this.logger.debug(`Lock acquired for stack: ${stackName} (${region}) after expired lock cleanup, owner: ${lockOwner}`);
+						this.trackHeldLock({
+							stackName,
+							region,
+							key,
+							info: lockInfo,
+							etag: retryEtag
+						});
 						return true;
 					} catch (retryError) {
-						if (retryError instanceof S3ServiceException && retryError.name === "PreconditionFailed") {
+						if (this.isForeignLockError(retryError)) {
 							this.logger.debug(`Lock was acquired by another process during expired lock cleanup for stack: ${stackName} (${region})`);
 							return false;
 						}
@@ -7782,6 +7998,24 @@ var LockManager = class {
 		}
 	}
 	/**
+	* Write the lock object and return the ETag S3 assigned it.
+	*
+	* `condition` defaults to `IfNoneMatch: '*'` (acquisition -- succeed only if
+	* no current version exists). Renewal passes `IfMatch: <etag>` instead.
+	*/
+	async putLockObject(key, lockInfo, condition = { IfNoneMatch: "*" }) {
+		const body = JSON.stringify(lockInfo, null, 2);
+		return (await this.s3Client.send(new PutObjectCommand({
+			Bucket: this.config.bucket,
+			...await this.ownerParam(),
+			Key: key,
+			Body: body,
+			ContentLength: Buffer.byteLength(body),
+			ContentType: "application/json",
+			...condition
+		}))).ETag;
+	}
+	/**
 	* Get current lock information.
 	*
 	* `region` is required for the new region-scoped lock layout. Pass
@@ -7789,6 +8023,18 @@ var LockManager = class {
 	* file (e.g. for state-listing tools that don't yet know the region).
 	*/
 	async getLockInfo(stackName, region) {
+		const record = await this.getLockRecord(stackName, region);
+		return record ? record.info : null;
+	}
+	/**
+	* `getLockInfo` plus the S3 ETag of the object the info came from.
+	*
+	* Internal because the ETag is only meaningful to code that then issues a
+	* CONDITIONAL write or delete against the exact bytes it read (issue #2168):
+	* the expired-lock takeover in `acquireLock`. Every public reader wants the
+	* body alone.
+	*/
+	async getLockRecord(stackName, region) {
 		await this.ensureClientForBucket();
 		const key = this.getLockKey(stackName, region);
 		try {
@@ -7812,7 +8058,10 @@ var LockManager = class {
 				...parsed.operation !== void 0 && { operation: displaySafe(parsed.operation) }
 			};
 			this.logger.debug(`Lock info for stack: ${stackName}:`, lockInfo);
-			return lockInfo;
+			return {
+				info: lockInfo,
+				etag: response.ETag
+			};
 		} catch (error) {
 			if (error instanceof NoSuchKey) {
 				this.logger.debug(`No lock exists for stack: ${stackName}`);
@@ -7834,24 +8083,137 @@ var LockManager = class {
 		return await this.getLockInfo(stackName, region) !== null;
 	}
 	/**
-	* Release a lock for a stack
+	* Release a lock for a stack.
+	*
+	* The DELETE is CONDITIONAL on the ETag this process last wrote (issue
+	* #2168). Before that it was an owner-blind unconditional delete, which is
+	* what turned a single lost lock into a cascade: an operation that outlived
+	* its TTL had its lock taken over by a second process, then deleted the
+	* SECOND process's lock on its way out, freeing the stack for a third.
+	*
+	* A `PreconditionFailed` therefore means "the object here is not the one I
+	* wrote", and the correct response is to leave it alone -- not to raise, as
+	* the operation itself has already finished and its caller has nothing to do
+	* about it.
+	*
+	* The condition is dropped for exactly ONE class of failure: the endpoint or
+	* the policy will not EVALUATE it (403 / 501 -- see
+	* `isConditionUnsupportedError`), and even then only after an ownership
+	* re-check. Everything else RAISES, as this method always has. In particular
+	* a 409 (S3's answer to a concurrent operation on the key) and a 503 are not
+	* fallback-worthy: the first IS the contended case, and the second may mean
+	* the delete already landed with the response lost. The heartbeat is stopped
+	* by then, so the worst outcome of raising is a lock that lapses at its TTL
+	* -- recoverable, unlike one deleted out from under a live writer.
+	*
+	* Callers must therefore tolerate a throw here, and all sixteen do: four
+	* wrap it in `try`/`catch` (`deploy-engine.ts` plus three in
+	* `destroy-runner.ts`) and twelve attach a `.catch()`: a
+	* failed release is a warning, never the error a command reports.
 	*/
 	async releaseLock(stackName, region) {
-		await this.ensureClientForBucket();
 		const key = this.getLockKey(stackName, region);
+		const held = this.heldLocks.get(key);
+		if (held?.releasing) {
+			this.logger.debug(`Release already in flight (or done) for stack ${stackName} (${region})`);
+			return held.releasing;
+		}
+		if (!held) return this.doReleaseLock(stackName, region, void 0);
+		this.stopRenewal(held);
+		const releasing = this.doReleaseLock(stackName, region, held);
+		held.releasing = releasing;
+		return releasing;
+	}
+	async doReleaseLock(stackName, region, held) {
+		await this.ensureClientForBucket();
+		if (held) await held.renewing?.catch(() => void 0);
+		if (held?.lost) {
+			this.logger.warn(`Not releasing the lock for stack '${stackName}' (${region}): this process lost it while the operation was still running, so the lock present now belongs to someone else.`);
+			return;
+		}
+		if (held && held.etag === void 0 && !await this.stillOursByBody(held)) {
+			this.logger.warn(`Not releasing the lock for stack '${stackName}' (${region}): this process never learned which version of the lock it wrote, and could not confirm the one present is its own. It expires on its own, or clear it with cdkd force-unlock.`);
+			return;
+		}
 		try {
 			this.logger.debug(`Releasing lock for stack: ${stackName} (${region})`);
-			await this.s3Client.send(new DeleteObjectCommand({
-				Bucket: this.config.bucket,
-				...await this.ownerParam(),
-				Key: key
-			}));
+			await this.deleteLock(stackName, region, held?.etag);
 			this.logger.debug(`Lock released for stack: ${stackName} (${region})`);
 		} catch (error) {
+			if (this.isForeignLockError(error)) {
+				this.logger.warn(held?.etagUncertain ? `Not releasing the lock for stack '${stackName}' (${region}): this process could not confirm which version of the lock it last wrote, so it will not delete one it may not own. The lock clears on its own at ${new Date(held.info.expiresAt).toISOString()}, or immediately with cdkd force-unlock.` : `Not releasing the lock for stack '${stackName}' (${region}): it has been replaced since this process acquired it, so another cdkd process now holds it. Leaving it in place.`);
+				return;
+			}
+			if (this.isGoneError(error)) {
+				this.logger.debug(`Lock for stack ${stackName} (${region}) was already gone`);
+				return;
+			}
+			if (held?.etag !== void 0 && this.isConditionUnsupportedError(error)) {
+				if (!await this.stillOursByBody(held)) {
+					this.logger.warn(`Not releasing the lock for stack '${stackName}' (${region}): the conditional delete could not be evaluated here, and this process could not confirm the lock is still its own. Leaving it in place rather than risk deleting another process's lock. It expires on its own, or clear it with cdkd force-unlock. If this repeats, grant s3:GetObject on the lock key -- a delete conditioned on an ETag requires it.`);
+					return;
+				}
+				this.logger.debug(`Conditional lock release for stack ${stackName} (${region}) is not supported here (${error instanceof Error ? error.message : String(error)}); retrying unconditionally`);
+				try {
+					await this.deleteLock(stackName, region);
+					this.logger.debug(`Lock released for stack: ${stackName} (${region})`);
+					return;
+				} catch (fallbackError) {
+					throw new LockError(`Failed to release lock for stack '${stackName}' (${region}): ${fallbackError instanceof Error ? fallbackError.message : String(fallbackError)}`, fallbackError instanceof Error ? fallbackError : void 0);
+				}
+			}
 			throw new LockError(`Failed to release lock for stack '${stackName}' (${region}): ${error instanceof Error ? error.message : String(error)}`, error instanceof Error ? error : void 0);
 		}
 	}
 	/**
+	* Is the stored lock still the one this process acquired?
+	*
+	* Used only where the ETag condition could not be EVALUATED, to decide
+	* whether dropping it is safe. Two earlier cuts of this were wrong in
+	* opposite directions and both are worth stating, because the shape recurs:
+	*
+	* - It short-circuited on `Date.now() < held.info.expiresAt`, reasoning that
+	*   nobody could have taken over while our own deadline was ahead. But
+	*   `forceReleaseLock` deletes regardless of expiry -- that is its whole
+	*   contract -- so a user running `cdkd force-unlock` mid-operation is a
+	*   LEGITIMATE takeover the shortcut cannot see. Cross-machine clock skew
+	*   reaches the same state without anyone running anything. The shortcut is
+	*   gone; the read costs one GetObject on an already-failed path.
+	*
+	* - It answered TRUE when the read FAILED, to avoid stranding a lock. That
+	*   made it inert in exactly the case it exists for: the documented trigger
+	*   for the 403 is a policy granting `s3:DeleteObject` without the
+	*   `s3:GetObject` a conditional delete needs -- under which this read fails
+	*   too. So the guard would wave through precisely the situation it was
+	*   added to catch. A failed read now REFUSES.
+	*
+	* The remaining asymmetry is deliberate and is this method's stated rule: a
+	* stranded lock is bounded by the TTL and clearable with `force-unlock`,
+	* while a lock deleted out from under a live writer is neither.
+	*/
+	async stillOursByBody(held) {
+		let record;
+		try {
+			record = await this.getLockRecord(held.stackName, held.region);
+		} catch {
+			return false;
+		}
+		if (!record) return false;
+		return this.sameLockIdentity(record.info, held.info);
+	}
+	/**
+	* Whether two lock bodies name the same acquisition.
+	*
+	* `owner` is compared through `displaySafe` on BOTH sides: a body read back
+	* has been sanitized by `getLockRecord` while the one this process
+	* constructed has not, so an unsanitized comparison would never match for a
+	* `$USER` or hostname containing a stripped codepoint -- and the process
+	* would then disown its own lock.
+	*/
+	sameLockIdentity(a, b) {
+		return displaySafe(a.owner) === displaySafe(b.owner) && a.timestamp === b.timestamp;
+	}
+	/**
 	* Force release a lock regardless of owner or expiry status
 	*
 	* This is intended for CLI usage (e.g., --force-unlock flag) when a lock
@@ -7864,21 +8226,213 @@ var LockManager = class {
 		const where = `${stackName}${region ? ` (${region})` : ""}`;
 		const lockInfo = await this.getLockInfo(stackName, region).catch(() => null);
 		this.logger.warn(lockInfo ? `Force releasing lock for stack: ${where}, owner: ${lockInfo.owner}${lockInfo.operation ? `, operation: ${lockInfo.operation}` : ""}, expired: ${this.isLockExpired(lockInfo)}` : `Force releasing lock for stack: ${where} (no lock body read — absent or unparseable; deleting the object either way, since a lock cdkd cannot read is a lock nothing else can clear)`);
+		const held = this.heldLocks.get(this.getLockKey(stackName, region));
+		if (held) {
+			this.stopRenewal(held);
+			held.releasing = Promise.resolve();
+		}
 		await this.deleteLock(stackName, region);
 	}
 	/**
-	* Internal method to delete the lock file from S3
+	* Internal method to delete the lock file from S3.
+	*
+	* When `etag` is supplied the delete is conditional (`IfMatch`), so it
+	* removes the object ONLY while it is still byte-identical to the one the
+	* caller read or wrote. S3 evaluates the condition against the CURRENT
+	* version, which is the right unit here even on the versioned state bucket:
+	* the current version IS the live lock.
 	*/
-	async deleteLock(stackName, region) {
+	async deleteLock(stackName, region, etag) {
 		await this.ensureClientForBucket();
 		const key = this.getLockKey(stackName, region);
 		await this.s3Client.send(new DeleteObjectCommand({
 			Bucket: this.config.bucket,
 			...await this.ownerParam(),
-			Key: key
+			Key: key,
+			...etag !== void 0 && { IfMatch: etag }
 		}));
 	}
 	/**
+	* Record a lock this process now holds and start renewing it.
+	*/
+	trackHeldLock(args) {
+		const previous = this.heldLocks.get(args.key);
+		if (previous) this.stopRenewal(previous);
+		const held = {
+			stackName: args.stackName,
+			region: args.region,
+			key: args.key,
+			info: args.info,
+			etag: args.etag,
+			timer: void 0,
+			renewing: void 0,
+			lost: false,
+			releasing: void 0,
+			etagUncertain: false,
+			warnedPastExpiry: false
+		};
+		this.heldLocks.set(args.key, held);
+		if (this.renewalDisabled) {
+			this.logger.debug(`Lock renewal is disabled; the lock for ${args.stackName} (${args.region}) will lapse at its TTL`);
+			return;
+		}
+		if (args.etag === void 0) {
+			this.logger.debug(`No ETag returned when acquiring the lock for ${args.stackName} (${args.region}); renewal disabled for this lock`);
+			return;
+		}
+		this.startRenewal(held);
+	}
+	startRenewal(held) {
+		const timer = setInterval(() => {
+			this.renewLock(held);
+		}, this.renewalIntervalMs);
+		timer.unref?.();
+		held.timer = timer;
+	}
+	stopRenewal(held) {
+		if (held.timer !== void 0) {
+			clearInterval(held.timer);
+			held.timer = void 0;
+		}
+	}
+	/**
+	* Push the lock's `expiresAt` forward, conditional on still owning it.
+	*
+	* This is what makes the TTL mean "the owner has been silent for TTL"
+	* instead of "the operation has been running for TTL". Before issue #2168
+	* there was no renewal at all, so any operation slower than the TTL -- an
+	* FSx or EMR resource waiting up to an hour, or simply a large stack --
+	* had its lock treated as free by the next process while it was still
+	* running.
+	*/
+	renewLock(held) {
+		if (held.lost || held.renewing !== void 0 || held.etag === void 0) return Promise.resolve();
+		const inFlight = this.doRenewLock(held).finally(() => {
+			held.renewing = void 0;
+		});
+		held.renewing = inFlight;
+		return inFlight;
+	}
+	async doRenewLock(held) {
+		const currentEtag = held.etag;
+		if (currentEtag === void 0) return;
+		const renewed = {
+			...held.info,
+			expiresAt: Date.now() + this.ttlMs
+		};
+		try {
+			const etag = await this.putLockObject(held.key, renewed, { IfMatch: currentEtag });
+			if (etag === void 0) {
+				if (await this.adoptOwnWrite(held, renewed)) return;
+				held.info = renewed;
+				held.etagUncertain = true;
+				this.stopRenewal(held);
+				this.logger.debug(`Lock renewal for ${held.stackName} (${held.region}) returned no ETag and the object could not be re-read; stopping renewal and keeping the previous ETag`);
+				return;
+			}
+			held.info = renewed;
+			held.etag = etag;
+			held.warnedPastExpiry = false;
+			this.logger.debug(`Renewed lock for stack: ${held.stackName} (${held.region}) until ${new Date(renewed.expiresAt).toISOString()}`);
+		} catch (error) {
+			if (this.isForeignLockError(error) && await this.adoptOwnWrite(held, renewed)) return;
+			if (this.isNotOursError(error)) {
+				held.lost = true;
+				this.stopRenewal(held);
+				this.logger.warn(`Lost the lock for stack '${held.stackName}' (${held.region}) while the operation was still running: the lock object has been replaced or removed. Another cdkd process may now be writing to this stack concurrently. This process will not delete the current lock when it finishes.`);
+				return;
+			}
+			this.logger.debug(`Lock renewal for stack ${held.stackName} (${held.region}) failed, will retry: ${error instanceof Error ? error.message : String(error)}`);
+			if (!held.warnedPastExpiry && Date.now() >= held.info.expiresAt) {
+				held.warnedPastExpiry = true;
+				this.logger.warn(`Lock renewal for stack '${held.stackName}' (${held.region}) has been failing long enough that the lock expired at ${new Date(held.info.expiresAt).toISOString()}. Another cdkd process can now take it while this operation is still running. Renewal keeps retrying.`);
+			}
+		}
+	}
+	/**
+	* Recover from a 412 that this process itself caused.
+	*
+	* A conditional PUT that S3 APPLIED but whose response never arrived -- a
+	* dropped connection, or an SDK-internal retry of the same request -- leaves
+	* `held.etag` pointing at the PREVIOUS version while the object already
+	* holds the renewal. The retry then carries the stale `IfMatch` and S3
+	* correctly answers 412. Reading that as "someone took my lock" is wrong in
+	* both directions: it stops the heartbeat on a lock this process still owns,
+	* it prints a warning naming a concurrent writer that does not exist, and
+	* `releaseLock` then refuses to remove the process's OWN lock -- stranding
+	* the stack for up to a full TTL, which is strictly worse than the
+	* unconditional delete this change replaced.
+	*
+	* So a 412 is disambiguated by READING the object once. `renewed` is a body
+	* only this process could have produced: its `owner` identifies the process
+	* and its `expiresAt` is a millisecond timestamp this specific PUT chose. An
+	* exact match on both (plus `timestamp`, which is fixed at acquisition) means
+	* the write landed and only the answer was lost, so the renewal is adopted
+	* rather than mourned.
+	*
+	* The read is on the 412 path only, which is rare. If it fails, the caller
+	* falls through to the pessimistic branch -- an unreadable lock is not
+	* evidence of ownership.
+	*/
+	async adoptOwnWrite(held, renewed) {
+		const record = await this.getLockRecord(held.stackName, held.region).catch(() => null);
+		if (!record || record.etag === void 0 || record.info.expiresAt !== renewed.expiresAt || !this.sameLockIdentity(record.info, renewed)) return false;
+		held.info = renewed;
+		held.etag = record.etag;
+		held.warnedPastExpiry = false;
+		this.logger.debug(`Lock renewal for stack ${held.stackName} (${held.region}) reported a conflict, but the object holds this process's own renewal -- adopting it and continuing`);
+		return true;
+	}
+	/**
+	* S3 told us the object is not the one we wrote (someone else replaced it).
+	*
+	* Matched on the status as well as the name: a 412 arriving as a bare
+	* `S3ServiceException`, or under a renamed code, would otherwise skip the
+	* "leave it alone" branch and reach the destructive fallback below it.
+	*/
+	isForeignLockError(error) {
+		return error instanceof S3ServiceException && (error.name === "PreconditionFailed" || error.$metadata.httpStatusCode === 412);
+	}
+	/**
+	* S3 told us this OBJECT is not there at all.
+	*
+	* `NoSuchBucket` is also a 404 and must NOT count: it says nothing about the
+	* lock. Read as "gone" it would make `releaseLock` resolve where it used to
+	* raise, and -- worse -- make one bucket-level 404 during renewal set
+	* `lost`, killing the heartbeat and refusing to release a lock this process
+	* still holds.
+	*/
+	isGoneError(error) {
+		if (error instanceof NoSuchKey) return true;
+		if (!(error instanceof S3ServiceException)) return false;
+		if (error.name === "NoSuchBucket") return false;
+		return error.name === "NoSuchKey" || error.$metadata.httpStatusCode === 404;
+	}
+	/**
+	* The endpoint or the policy will not evaluate a conditional delete at all.
+	*
+	* Deliberately narrow, because this is the one predicate that authorises
+	* dropping the ownership check. A conditional delete with a specific ETag
+	* additionally requires `s3:GetObject` (AWS documents this for its
+	* enforce-conditional-deletes bucket policy), so a policy granting only
+	* `s3:DeleteObject` answers 403 -- and an S3-compatible endpoint that has
+	* not implemented the header answers 501. Neither says anything about who
+	* owns the lock, whereas 409 / 412 / 5xx all do.
+	*/
+	isConditionUnsupportedError(error) {
+		if (!(error instanceof S3ServiceException)) return false;
+		const status = error.$metadata.httpStatusCode;
+		return status === 403 || status === 501 || error.name === "AccessDenied" || error.name === "Forbidden" || error.name === "NotImplemented";
+	}
+	/**
+	* Either of the two ways S3 can tell us the lock we thought we held is no
+	* longer ours: replaced by someone else (412) or deleted outright (404, e.g.
+	* by `cdkd force-unlock`). Both mean stop renewing and do not delete.
+	*/
+	isNotOursError(error) {
+		return this.isForeignLockError(error) || this.isGoneError(error);
+	}
+	/**
 	* Acquire lock with retry logic
 	*
 	* Retries up to maxRetries times with retryDelay between attempts.
@@ -17609,7 +18163,7 @@ var CloudControlProvider = class {
 		if (context?.finalSnapshotIdentifier !== void 0) throw new ProvisioningError(`${logicalId} (${resourceType}) requires a final snapshot (DeletionPolicy: Snapshot), but the Cloud Control API delete route has no final-snapshot parameter. Re-run with --skip-final-snapshot after snapshotting manually, or retain the resource.`, resourceType, logicalId, physicalId);
 		if (context?.removeProtection === true && resourceType === "AWS::AutoScaling::AutoScalingGroup") {
 			this.logger.debug(`Delegating protected AutoScalingGroup ${logicalId} delete to the SDK ASGProvider (Cloud Control cannot force-delete a protected ASG)`);
-			const { ASGProvider } = await import("./asg-provider-D0lenV1M.js").then((n) => n.n);
+			const { ASGProvider } = await import("./asg-provider-DIKQ3APM.js").then((n) => n.n);
 			return await new ASGProvider().delete(logicalId, physicalId, resourceType, _properties, context);
 		}
 		const isProtectedEc2Instance = context?.removeProtection === true && resourceType === "AWS::EC2::Instance";
@@ -26305,7 +26859,7 @@ const FLUSH_INTERVAL_MS = 2e3;
 const FLUSH_EVENT_THRESHOLD = 50;
 /** Build-time cdkd version, with a dev fallback for non-built contexts. */
 function getCdkdVersion() {
-	return "0.284.41";
+	return "0.284.43";
 }
 /**
 * Generate a time-sortable unique run id, e.g.
@@ -28927,5 +29481,5 @@ var DeployEngine = class {
 };
 
 //#endregion
-export { startInterruptWatch as $, CdkdError as $n, WorkGraph as $t, renderStatefulReason as A, resolveStateBucketWithDefault as An, redactSecretsForState as At, exportAliasCollisionScrubWarning as B, expectedOwnerParam as Bn, DiffCalculator as Bt, isFinalSnapshotError as C, synthesisStatusMessage as Cn, isMarkedNonRetryable as Cr, TEMPLATE_SOURCED_RULES as Ct, extractDeploymentEventError as D, resolveAutoAssetStorage as Dn, __exportAll as Dr, isSingleDynamicReferenceToken as Dt, makeCanonicalizePropertiesFn as E, resolveApp as En, markNonRetryable as Er, errorCauseChain as Et, green as F, CFN_TEMPLATE_BODY_LIMIT as Fn, s3BucketDomainName as Ft, collectInlinePolicyNamesManagedBySiblings as G, processStackMessages as Gn, TemplateParser as Gt, secretBearingStateKeyWarning as H, canonicalizeRegion as Hn, describeTypeWithThrottleRetry as Ht, red as I, CFN_TEMPLATE_URL_LIMIT as In, s3BucketDualStackDomainName as It, findActionableSilentDrops as J, AwsClients as Jn, S3StateBackend as Jt, clearOnUpdateRemoval as K, clearBucketRegionCache as Kn, LockManager as Kt, yellow as L, MIGRATE_TMP_PREFIX as Ln, s3BucketRegionalDomainName as Lt, bold as M, resolveUseCdkBootstrapAssets as Mn, classifyReplaySecretRegion as Mt, cyan as N, stateBucketExistenceConfirmed as Nn, producerRegionsFromState as Nt, MULTI_REGION_RECREATE_BLOCKED_TYPES as O, resolveCaptureObservedState as On, maskSecretsInError as Ot, gray as P, warnDeprecatedNoPrefixCliFlag as Pn, s3BucketArn as Pt, isInterruptedWaitError as Q, AssetError as Qn, stringifyValue as Qt, collectDeclaredOutputNames as R, findLargeInlineResources as Rn, s3BucketWebsiteUrl as Rt, createPreDeleteFinalSnapshot as S, Synthesizer as Sn, withErrorHandling as Sr, STATE_SOURCED_READBACK_RULES as St, unsupportedFinalSnapshotError as T, getLegacyStateBucketName as Tn, isThrottlingError as Tr, dynamicReferenceTokens as Tt, stateKeySecretExposure as U, derivePartitionAndUrlSuffix as Un, withRetry as Ut, isExportAliasCollision as V, PARTITION_TABLE as Vn, INTRINSIC_KEYS as Vt, IAMRoleProvider as W, AssemblyReader as Wn, DagBuilder as Wt, beginCommandInterruptScope as X, resetAwsClients as Xn, shouldRetainResource as Xt, findSilentDropProperties as Y, getAwsClients as Yn, rebuildClientForBucketRegion as Yt, endCommandInterruptScope as Z, setAwsClients as Zn, AssetPublisher as Zt, computeImplicitDeleteEdges as _, getDockerCmd as _n, StateError as _r, replayWarn as _t, DeploymentEventsStore as a, stripControlChars as an, LocalInvokeBuildError as ar, carriesDynamicReference as at, buildFinalSnapshotIdentifier as b, AssetManifestLoader as bn, isCdkdError as br, requireConfigString as bt, replayFailedOperations as c, ensureAssetStorage as cn, LockError as cr, refStateLookupFromResource as ct, updatePartialReason as d, readBootstrapMarkerBody as dn, PartialFailureError as dr, resolveExplicitPhysicalId as dt, buildAssetRedirectMap as en, ConfigError as er, CloudControlProvider as et, UNSPECIFIED_SKIP_REASON as f, validateAssetBucketName as fn, ProvisioningError as fr, assertRegionMatch as ft, IMPLICIT_DELETE_DEPENDENCIES as g, formatDockerLoginError as gn, StackTerminationProtectionError as gr, readConfigString as gt, maskingRetryLogger as h, buildDockerImage as hn, StackHasActiveImportsError as hr, configStringRefusal as ht, DeploymentEventsReader as i, escapeRegExp$1 as in, DynamicReferenceRegionAmbiguousError as ir, IntrinsicFunctionResolver as it, formatResourceLine as j, resolveStateBucketWithDefaultAndSource as jn, scrubResourceRecord as jt, isStatefulRecreateTargetSync as k, resolveSkipPrefix as kn, maskSecretsInText as kt, replayRollback as l, getBootstrapMarkerKey as ln, MissingCdkCliError as lr, WAFv2WebACLProvider as lt, withResourceDeadline as m, buildDenyExternalAccessPolicy as mn, ResourceUpdateNotSupportedError as mr, configBooleanRefusal as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, loadPublishableAssetManifest as nn, DependencyError as nr, disableInstanceApiTermination as nt, planFailedOps as o, AssetModeResolver as on, LocalMigrateError as or, cfnRefValueFromPhysicalId as ot, deleteSkipReason as p, validateContainerRepoName as pn, ResourceTimeoutError as pr, coerceCfnBoolean as pt, ProviderRegistry as q, resolveBucketRegion as qn, displaySafe as qt, DeployEngine as r, rewriteTemplateAssetReferences as rn, DeployCancelledError as rr, isTerminationProtectionPropagationError as rt, planRollback as s, BOOTSTRAP_MARKER_PREFIX as sn, LocalStartServiceError as sr, getAccountInfo as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, createAssetRedirectResolver as tn, CrossAccountSecretRefusalError as tr, slowCcOperationTimeoutMs as tt, updatePartialMessage as u, parseBootstrapMarker as un, NestedStackChildDirectDestroyError as ur, normalizeAwsTagsToCfn as ut, ATOMIC_FINAL_SNAPSHOT_TYPES as v, runDockerForeground as vn, SynthesisError as vr, requireConfigArray as vt, refusesFinalSnapshot as w, getDefaultStateBucketName as wn, isRetryableTransientError as wr, createSecretMasker as wt, ccRoutedFinalSnapshotError as x, getDockerImageBySourceHash as xn, normalizeAwsError as xr, STATE_SOURCED_CROSS_GENERATION_RULES as xt, PRE_DELETE_SNAPSHOT_TYPES as y, runDockerStreaming as yn, formatError as yr, requireConfigObject as yt, collectPublishedOutputNames as z, uploadCfnTemplate as zn, applyRoleArnIfSet as zt };
-//# sourceMappingURL=deploy-engine-CCWl_tAH.js.map
+export { startInterruptWatch as $, setAwsClients as $n, WorkGraph as $t, renderStatefulReason as A, resolveCaptureObservedState as An, redactSecretsForState as At, exportAliasCollisionScrubWarning as B, findLargeInlineResources as Bn, DiffCalculator as Bt, isFinalSnapshotError as C, getDockerImageBySourceHash as Cn, normalizeAwsError as Cr, TEMPLATE_SOURCED_RULES as Ct, extractDeploymentEventError as D, getLegacyStateBucketName as Dn, isThrottlingError as Dr, isSingleDynamicReferenceToken as Dt, makeCanonicalizePropertiesFn as E, getDefaultStateBucketName as En, isRetryableTransientError as Er, errorCauseChain as Et, green as F, stateBucketExistenceConfirmed as Fn, s3BucketDomainName as Ft, collectInlinePolicyNamesManagedBySiblings as G, derivePartitionAndUrlSuffix as Gn, TemplateParser as Gt, secretBearingStateKeyWarning as H, expectedOwnerParam as Hn, describeTypeWithThrottleRetry as Ht, red as I, warnDeprecatedNoPrefixCliFlag as In, s3BucketDualStackDomainName as It, findActionableSilentDrops as J, clearBucketRegionCache as Jn, S3StateBackend as Jt, clearOnUpdateRemoval as K, AssemblyReader as Kn, LockManager as Kt, yellow as L, CFN_TEMPLATE_BODY_LIMIT as Ln, s3BucketRegionalDomainName as Lt, bold as M, resolveStateBucketWithDefault as Mn, classifyReplaySecretRegion as Mt, cyan as N, resolveStateBucketWithDefaultAndSource as Nn, producerRegionsFromState as Nt, MULTI_REGION_RECREATE_BLOCKED_TYPES as O, resolveApp as On, markNonRetryable as Or, maskSecretsInError as Ot, gray as P, resolveUseCdkBootstrapAssets as Pn, s3BucketArn as Pt, isInterruptedWaitError as Q, resetAwsClients as Qn, stringifyValue as Qt, collectDeclaredOutputNames as R, CFN_TEMPLATE_URL_LIMIT as Rn, s3BucketWebsiteUrl as Rt, createPreDeleteFinalSnapshot as S, AssetManifestLoader as Sn, isCdkdError as Sr, STATE_SOURCED_READBACK_RULES as St, unsupportedFinalSnapshotError as T, synthesisStatusMessage as Tn, isMarkedNonRetryable as Tr, dynamicReferenceTokens as Tt, stateKeySecretExposure as U, PARTITION_TABLE as Un, withRetry as Ut, isExportAliasCollision as V, uploadCfnTemplate as Vn, INTRINSIC_KEYS as Vt, IAMRoleProvider as W, canonicalizeRegion as Wn, DagBuilder as Wt, beginCommandInterruptScope as X, AwsClients as Xn, shouldRetainResource as Xt, findSilentDropProperties as Y, resolveBucketRegion as Yn, rebuildClientForBucketRegion as Yt, endCommandInterruptScope as Z, getAwsClients as Zn, AssetPublisher as Zt, computeImplicitDeleteEdges as _, formatDockerLoginError as _n, StackHasActiveImportsError as _r, replayWarn as _t, DeploymentEventsStore as a, stripControlChars as an, DeployCancelledError as ar, carriesDynamicReference as at, buildFinalSnapshotIdentifier as b, runDockerForeground as bn, SynthesisError as br, requireConfigString as bt, replayFailedOperations as c, ensureAssetStorage as cn, LocalMigrateError as cr, refStateLookupFromResource as ct, updatePartialReason as d, readBootstrapMarkerBody as dn, MissingCdkCliError as dr, resolveExplicitPhysicalId as dt, buildAssetRedirectMap as en, AssetError as er, CloudControlProvider as et, UNSPECIFIED_SKIP_REASON as f, validateAssetBucketName as fn, NestedStackChildDirectDestroyError as fr, assertRegionMatch as ft, IMPLICIT_DELETE_DEPENDENCIES as g, dockerSpawnEnvWithSensitive as gn, ResourceUpdateNotSupportedError as gr, readConfigString as gt, maskingRetryLogger as h, buildDockerImage as hn, ResourceTimeoutError as hr, configStringRefusal as ht, DeploymentEventsReader as i, escapeRegExp$1 as in, DependencyError as ir, IntrinsicFunctionResolver as it, formatResourceLine as j, resolveSkipPrefix as jn, scrubResourceRecord as jt, isStatefulRecreateTargetSync as k, resolveAutoAssetStorage as kn, __exportAll as kr, maskSecretsInText as kt, replayRollback as l, getBootstrapMarkerKey as ln, LocalStartServiceError as lr, WAFv2WebACLProvider as lt, withResourceDeadline as m, buildDenyExternalAccessPolicy as mn, ProvisioningError as mr, configBooleanRefusal as mt, DEFAULT_RESOURCE_WARN_AFTER_MS as n, loadPublishableAssetManifest as nn, ConfigError as nr, disableInstanceApiTermination as nt, planFailedOps as o, AssetModeResolver as on, DynamicReferenceRegionAmbiguousError as or, cfnRefValueFromPhysicalId as ot, deleteSkipReason as p, validateContainerRepoName as pn, PartialFailureError as pr, coerceCfnBoolean as pt, ProviderRegistry as q, processStackMessages as qn, displaySafe as qt, DeployEngine as r, rewriteTemplateAssetReferences as rn, CrossAccountSecretRefusalError as rr, isTerminationProtectionPropagationError as rt, planRollback as s, BOOTSTRAP_MARKER_PREFIX as sn, LocalInvokeBuildError as sr, getAccountInfo as st, DEFAULT_RESOURCE_TIMEOUT_MS as t, createAssetRedirectResolver as tn, CdkdError as tr, slowCcOperationTimeoutMs as tt, updatePartialMessage as u, parseBootstrapMarker as un, LockError as ur, normalizeAwsTagsToCfn as ut, ATOMIC_FINAL_SNAPSHOT_TYPES as v, getDockerCmd as vn, StackTerminationProtectionError as vr, requireConfigArray as vt, refusesFinalSnapshot as w, Synthesizer as wn, withErrorHandling as wr, createSecretMasker as wt, ccRoutedFinalSnapshotError as x, runDockerStreaming as xn, formatError as xr, STATE_SOURCED_CROSS_GENERATION_RULES as xt, PRE_DELETE_SNAPSHOT_TYPES as y, partitionSensitiveEnv as yn, StateError as yr, requireConfigObject as yt, collectPublishedOutputNames as z, MIGRATE_TMP_PREFIX as zn, applyRoleArnIfSet as zt };
+//# sourceMappingURL=deploy-engine-bFTrzeeu.js.map